01 · Product name
Wireshark
Open a pcap and filter the packets.
Published by Wireshark Foundation.
In short
Wireshark is the packet analyzer from the Wireshark Foundation. The download page on 18 Oct 2026 listed stable release 4.6.9. The GitHub mirror's SPDX field is GPL-2.0. This listing opened Wireshark 4.2.2, the Ubuntu package, on the project's sample http2_follow_multistream.pcapng. The packet list showed a TCP handshake and a TLS client hello with SNI www.mozilla.org. A display filter on the server-name field left that client hello. A packet is what the file contains. It is not proof of who sat at the keyboard.
Product pricing strategy
02
Free
The download page does not print a price for the stable Windows, macOS, or source builds. The SPDX field is GPL-2.0. This listing does not add a support contract or a training seat the page did not show. The binary used here came from Ubuntu's wireshark 4.2.2 package, which is the distribution's build of that GPL code, not a second product. If a reseller sells a packaged appliance with Wireshark on it, that price is the reseller's. Cite the download page for the stable version number and the SPDX field for the license.
Utility and features
03
Wireshark reads a capture and shows frames, a protocol tree, and display filters. The window opened here was version 4.2.2, built from the Ubuntu package. The file was Wireshark's own test capture http2_follow_multistream.pcapng, 197 frames. Frame 1 was a TCP SYN from 10.9.0.2 port 59246 to 104.16.40.2 port 443. Frame 4 was a TLSv1 client hello whose info line named www.mozilla.org. Filtering tls.handshake.extensions_server_name left the client hello and showed the extension value www.mozilla.org in the packet bytes.
- 4.2.2 opened the file. Ubuntu's Wireshark 4.2.2 showed 197 frames. The download page's stable label was 4.6.9.
- SNI www.mozilla.org. The client hello's server-name extension, and the display filter on that field, both showed www.mozilla.org.
- GPL-2.0 in the SPDX field. The GitHub mirror's license field is GPL-2.0. The download page did not print a price.
The download page's stable line was 4.6.9, with an old stable 4.4.19 and a development 4.7.4. Those are the page's version labels. The binary that drew the window printed 4.2.2. Quote both. The SPDX field on the wireshark/wireshark mirror is GPL-2.0. TShark is the command-line reader in the same package. tcpdump is a different project. Zeek and Suricata turn the same file into logs and events. Wireshark is the place you look when the question is a frame.
- 1
Open the pcap and read the info column before you write a conclusion.
- 2
Apply a display filter and say which frames it removed.
- 3
Quote the binary version and the download-page stable version separately.
Caveats
04
The sample file is a public test capture of a client talking to www.mozilla.org. The addresses 10.9.0.2 and 104.16.40.2 belong to that file. They are not this machine and not a person. A client hello names the name the client sent. It does not prove who typed it, and it does not decrypt the session. This window did not have the TLS keys.
Version 4.2.2 is the package that ran. Version 4.6.9 is the download page's stable label the same day. Do not write one number for both. A display filter hides frames. The hidden frames are still in the file. Capturing traffic on a network you do not administer is a different act from opening a file you were given. This listing opened a file.
Screenshots
05
Potential use cases
06
- Someone hands you a pcap and asks what the client requested. Open it and read the info column before you write a conclusion. On 18 Oct 2026 Wireshark 4.2.2 showed 197 frames in http2_follow_multistream.pcapng. Frame 1 was a TCP SYN from 10.9.0.2 to 104.16.40.2 port 443. Frame 4 was a TLS client hello naming www.mozilla.org.
- You need the server name without the rest of the file. Apply tls.handshake.extensions_server_name and say which frames remain. The filter left the client hello and the extension value www.mozilla.org. The other frames are still in the file. This window did not have TLS keys, so the HTTP/2 payload stayed encrypted.
- A report is about to say Wireshark 4.6.9 produced the window. The download page listed stable 4.6.9, old stable 4.4.19, and development 4.7.4. The binary that drew the window printed 4.2.2. Quote both. The SPDX field is GPL-2.0. The addresses belong to the sample, not to this machine.
Hard cases
The case where the first result is easy to over-read.
The client hello is called the user
A server name in a TLS client hello is the name the client sent. It is not a person, and it does not decrypt the session. The sample is Wireshark's own public test file. Keep 4.2.2 as the build that displayed it and 4.6.9 as the download page's stable label the same day. A display filter hides frames. It does not delete them.
Practitioners using it
Posts on X from people describing a concrete use. The quote is the post. Likes and reposts are the counts saved with it, not a live total. A label marks a creator, a maintainer, a vendor, a partner, a data partner, or an investor.
I Analyzed a PCAP on Wireshark and detected a QakBot infection chain. I Found a .dat file being downloaded via curl turned out to be a Windows executable with an MZ header in disguise. I extracted the file, generated its SHA256 hash, and checked it on VirusTotal and MalwareBazaar pic.twitter.com/3R8D2JewJe
#BlueTeamer #100DaysOfCybersecurity Day 4 Today I practiced extracting objects from HTTP traffic using Wireshark. I opened a PCAP file, filtered for HTTP traffic, and used File → Export Objects → HTTP to extract files transferred during the session. After saving the… https://t.co/Ry0vjesPHW pic.twitter.com/jL37xu114F
This week, I used the recent @LinusTech channel takeover as an opportunity to perform some basic malware analysis on YT sponsor scams. I fired up Procmon and Wireshark to help me in my analysis and discoverd the Redline Trojan. This was a fun project - https://t.co/hd8TS9MPPg
Was able to replicate all the traffic headed to my motorized shades bridge onto another port on the switch, then snoop the traffic with Wireshark, so I could see what the app was sending to put them up or down. Now, Alexa can do it because it's a trivial shell command.
Network acting up so I fired up Wireshark. Now I need to know why my key lights are trying to talk to my hue lights and exactly why the dishwasher is encrypting its conversations with the aquarium automation system... I smell a mutiny! #iot #network
Questions
Is Wireshark free?
The download page did not print a price. The GitHub mirror's SPDX field is GPL-2.0. The build this listing ran was Ubuntu's 4.2.2 package.
Which version was used?
Wireshark 4.2.2 opened the sample. The download page the same day listed stable release 4.6.9.
Citations
07
Titled sources. These public pages are what the quotes on this listing come from.
Product
Wireshark
https://www.wireshark.org/Pricing
Wireshark download
https://www.wireshark.org/download.htmlDocumentation
Wireshark repository
https://github.com/wireshark/wireshark